Sony hacked again, another 1m passwords exposed

LulzSecurity (LulzSec), a group of hackers that recently gained notoriety for hacking PBS.org's home page with an image of NyanCat, announced Thursday that it has stolen data from Sony. It's yet another in a seemingly endless string of embarrassing security incidents for the company, but what's shocking is just how exposed the data was to begin with.

In a press release posted to their Web site, LulzSec claims to have broken into SonyPictures.com and "compromised over 1,000,000 users' personal information, including passwords, email addresses, home addresses, dates of birth, and all Sony opt-in data associated with their accounts."

The theft included 75,000 "music codes" and 3.5 million "music coupons," according to the group. LulzSec has posted segments of data they claim to have taken from Sony's server to serve as proof of their accomplishment.

There are two astonishing twists to this story - one is that LulzSec was apparently able to access the information fairly easily, using what they describe as "a very simple SQL injection, one of the most primitive and common vulnerabilities." Secondly, "every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it's just a matter of taking it. This is disgraceful and insecure: they were asking for it."

If true, it's devastating news for Sony, which is just getting back on its feet after shutting down access to its PlayStation Network and Sony Online Entertainment servers after hackers made off with personal information on more than 100 million user accounts.

The PlayStation Network, which controls PlayStation 3 and PlayStation Portable users' ability to connect to one another to play online games, was down for more than three weeks through the last half of April and first half of May as Sony struggled to secure the system.

And only in the past 24 hours has Sony brought back its PlayStation Store, which serves as a way for PS3 and PSP users to download games and content for their systems.

Sony hasn't even yet initiated its "Welcome Back" package for consumers affected by the PSN blackout - a collection of about $100 worth of games and content, as well as access to the company's premium "PlayStation Plus" service.

SonyPictures.com isn't directly related to the PlayStation 3 or PlayStation Network - it's Sony's consumer-facing Internet site for information on their movies, television and home entertainment offerings on Blu-Ray Disc and other formats. But Sony's many Web sites and servers have been on the receiving end of security probes and hack attacks for some time, exacerbated by the company's legal proceedings against George "Geohot" Hotz, a programmer who sought to "jailbreak" or enable the PlayStation 3 console to support Linux operating system software - a feature Sony once supported itself, but later removed in a firmware update. Since the widely-publicized outage of the PlayStation Network, hackers have stepped up their attempts to break into Sony's systems.

More:

• Sony: ‘Full PSN Services’ return this week, including store
• PlayStation Network returns to parts of Asia, including Japan
• Sony opens identity protection service for PSN users
• Sony promises PlayStation Store by end of month
• Sony says PlayStation Store to come back May 24
• PlayStation Network login flaw exposed
• Sony details free games for PlayStation Network users
• Sony relaunches PlayStation Network
• Protracted PlayStation Network outage causes gamers to cash in PS3s, games
• Sony delays PlayStation Network restart, citing SOE break-in